Now all users are created by Admin and the role of new user is empty unless admin changes it.
Once we do have Anonym acces, we should allow visitors to create a user account for themselves.
Therefore, the admin should e able to pre-configure in advance which amount of freedom is granted for this self-created accounts, (probably you want the just created users to be able to read and also write in the wiki).
And this default role for self-created accounts is passed through ACL to validate actions (usual stuff).
Edit:
Probably the role assignment is a feature susceptible of being delegated, for example a "medium privilege user" that does have write permissions but not admin permissions to a bag, might raise the permissions of a basic user from just read up to "medium privilege user's trust level" (aka write acces)
Now all users are created by Admin and the role of new user is empty unless admin changes it.
Once we do have Anonym acces, we should allow visitors to create a user account for themselves.
Therefore, the admin should e able to pre-configure in advance which amount of freedom is granted for this self-created accounts, (probably you want the just created users to be able to read and also write in the wiki).
And this default role for self-created accounts is passed through ACL to validate actions (usual stuff).
Edit:
Probably the role assignment is a feature susceptible of being delegated, for example a "medium privilege user" that does have write permissions but not admin permissions to a bag, might raise the permissions of a basic user from just read up to "medium privilege user's trust level" (aka write acces)